lumma | 3438eb498ae03d4a380eb445797ab5f78b521d598422f450ede8dbe9c471ec0a

Analysis

user interaction
yes
max time kernel
154s
max time network
220s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 21:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Application.exe
Size 1001.1MB
Sample260802-1jet8ssdna
SHA256 3438eb498ae03d4a380eb445797ab5f78b521d598422f450ede8dbe9c471ec0a
MD5 3127ac987906f210f9a66cd7d7c57000
SHA1 16bab4c403109471ef69dfb9dae72c387f2170b8
SHA512 4ca9ea2aa4d33a688de4861e4d7906c8f39dea2d739d19a96d79b4db3a9e353e79125624fc18e14ce57b2dafe2b220ef3ca2ec971eb46c05f46140c8c88b07c5
SSDEEP 25165824:lFMPfmVq5Cqk+6/th46QiknHvMgDPapIhBFagCVpq1cVHPxvrV:vcZEq6/DynPMCVeq1cVr
TLSH
T18AB9330990FE47CCF51BF9F378B6A38D857B707AAC063AA51A52EB0C53BE5261D0C650
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution lumma spyware stealer trojan

Malware Config

Extracted

Family

lumma

https://p3ar11fter.sbs/api
https://3xp3cts1aim.sbs/api
https://owner-vacat10n.sbs/api
https://peepburry828.sbs/api
https://p10tgrace.sbs/api
https://befall-sm0ker.sbs/api
https://librari-night.sbs/api
https://processhol.sbs/api
https://milk-of-horned.cyou/api

Signatures

Family: Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Executes dropped EXE 1 IoCs

pid	Process
5760	Sweden.com

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1396	tasklist.exe
4700	tasklist.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\AmandaNode	Application.exe
File opened for modification	C:\Windows\HeritageWidespread	Application.exe
File opened for modification	C:\Windows\FirstRb	Application.exe
File opened for modification	C:\Windows\IsaPd	Application.exe
File opened for modification	C:\Windows\TrapMinimize	Application.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2032	cmd.exe
5592	cmd.exe
4148	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Application.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sweden.com

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\CA\Certificates\1B511ABEAD59C6CE207077C0BF0E0043B1382612	Sweden.com
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\SystemCertificates\CA\Certificates\1B511ABEAD59C6CE207077C0BF0E0043B1382612\Blob = 0300000001000000140000001b511abead59c6ce207077c0bf0e0043b1382612140000000100000014000000748580c066c7df37decfbd2937aa031dbeedcd176b0000000100000020000000c8025f9fc65fdfc95b3ca8cc7867b9a587b5277973957917463fc813d0b625a90f0000000100000020000000084440583bb98ad9c8aa908659d92200b66a41500a8abfe115c8fe5e622433d3190000000100000010000000b0d68e08e9f9b8d739eaf5c3a25ab51f5c00000001000000040000000008000018000000010000001000000014c3bd3549ee225aece13734ad8ca0b82000000001000000cc040000308204c8308203b0a00302010202100cf5bd062b5602f47ab8502c23ccf066300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3231303333303030303030305a170d3331303332393233353935395a3059310b300906035504061302555331153013060355040a130c446967694365727420496e63313330310603550403132a446967694365727420476c6f62616c20473220544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100ccf710624fa6bb636fed905256c56d277b7a12568af1f4f9d6e7e18fbd95abf260411570db1200fa270ab557385b7db2519371950e6a41945b351bfa7bfabbc5be2430fe56efc4f37d97e314f5144dcba710f216eaab22f031221161699026ba78d9971fe37d66ab75449573c8acffef5d0a8a5943e1acb23a0ff348fcd76b37c163dcde46d6db45fe7d23fd90e851071e51a35fed4946547f2c88c5f4139c97153c03e8a139dc690c32c1af16574c9447427ca2c89c7de6d44d54af4299a8c104c2779cd648e4ce11e02a8099f04370cf3f766bd14c49ab245ec20d82fd46a8ab6c93cc6252427592f89afa5e5eb2b061e51f1fb97f0998e83dfa837f4769a10203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414748580c066c7df37decfbd2937aa031dbeedcd17301f0603551d230418301680144e2254201895e6e36ee60ffafab912ed06178f39300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7447322e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7447322e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b0500038201010090f170cb289769977c74fdc0fa267b53abadcd65fdba9c069c8ad75a4387ed4d4c565fadc1c5b505202e59d1ff4af5a02ad8b095adc92e4a3bd7a7f66f8829fc303f2484bbc3b77b93072caf876b7633ed005552b2599ee4b9d0f3dfe70ffeddf8c4b910728109045fcf979e2e32758ecf9a58d257317e370181b2666d291ab166096dd16e90f4b9fa2f0114c55c566401d97d87a838539f8b5d466d5cc6278481d47e8c8ca39b52e7c688ec377c2afbf0555a387210d80013cf4c73dbaa3735a82981699c76bcde187b90d4cacfef6703fd045a2116b1ffea3fdfdc82f5ebf45992230d242a95254ccaa191e6d4b7ac8774b3f16da399dbf9d5bd84409f0798	Sweden.com

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5760	Sweden.com
5760	Sweden.com
5760	Sweden.com
5760	Sweden.com
5760	Sweden.com
5760	Sweden.com

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1396	tasklist.exe
Token: SeDebugPrivilege	4700	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5760	Sweden.com
5760	Sweden.com
5760	Sweden.com

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5760	Sweden.com
5760	Sweden.com
5760	Sweden.com

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 2032	4464	Application.exe	88
PID 2032 wrote to memory of 1396	2032	cmd.exe	90
PID 2032 wrote to memory of 1280	2032	cmd.exe	91
PID 2032 wrote to memory of 4700	2032	cmd.exe	93
PID 2032 wrote to memory of 1068	2032	cmd.exe	94
PID 2032 wrote to memory of 5592	2032	cmd.exe	95
PID 2032 wrote to memory of 4148	2032	cmd.exe	96
PID 2032 wrote to memory of 5760	2032	cmd.exe	97
PID 2032 wrote to memory of 3068	2032	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\Application.exe
"C:\Users\Admin\AppData\Local\Temp\Application.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Attributes Attributes.cmd & Attributes.cmd
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1396
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa opssvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1280
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1068
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 116069
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5592
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Sg + ..\Decisions + ..\Memories + ..\Lottery + ..\Propecia + ..\Hate + ..\Bondage j
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4148
- - C:\Users\Admin\AppData\Local\Temp\116069\Sweden.com
    Sweden.com j
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5760
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\Local\Temp\116069\j
Size 482KB
SHA256 540ceabb859236a91fbe543e1631da991e49c72587d4d8f35459789b49ecb19d
MD5 0efd1155a2f48bec95b5f26e3ef6a7e3
SHA1 a2df539bdf5b05717808ee8aa3c824bb71a18c2d
SHA512 0589c5c21ca993fdc4e39685d0b14a30e408e36e8be8200a3597c4d0267668abceee4fc08b42cd9e225a9c8adbe48cdb881a1816745855e06a75065115c64d90
SSDEEP 12288:6BKPLlxYYGM40re3cxFukKk7OVZDhhULhdiFpUxY5:6BgD40S3+gkKp/hqYUxY5
TLSH
T163A423C91FD8B219EAC3C9979AF60B0CD5855A14BCEC533DA5D6EE34C4F21E18D6C025
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Attributes

Path C:\Users\Admin\AppData\Local\Temp\Attributes
Size 9KB
SHA256 87344646546a990a3efcf03e73cbfe86213900318c160b19c2a5c7f0faf9664a
MD5 544035b0ee6b3c75edbecb690b2ee53f
SHA1 30b03ccd08c33ae1524e7c39746b12b7359f089c
SHA512 a246c5e26a1b828415390a7b48ac2cb10d6b88e437e5e757ca79b7b8ffaf96b59513e10487c9255a31078fe7a59f18e8e2067a2f678283455a898ac5523dc1ca
SSDEEP 192:HVX5zukSpDecNuwWdLiSpxDeSrbuZwPukbF+iCzp+AXzRA64FgSRbUR4RSWdY6ep:1XQkPU0xiSfeXwPxF+xNlX2643b0sA3
TLSH
T105125AB1AA84081560E66B9FF2C77D59BA71ACC3432E815DCC8B514D0749EEC032F9BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bondage

Path C:\Users\Admin\AppData\Local\Temp\Bondage
Size 4KB
SHA256 4b5ae15680efc8292ef66e46850b4b4504251504f894acc9acdb5fae9b24b98d
MD5 1e23599f509e7024a0b089533372ad5a
SHA1 888f963d41305bfbe0a9873e73fdfb3c0a47be5f
SHA512 0058cfa153704ddd44f940182831fa81cf25f860a25047e8100daaf7293c5edeaaa9357c5a4a74c2b5de4f5d2da2a814af7e52285bbcfc8f1ce2d220a33b3b4c
SSDEEP 96:6bfIazNQcOYBx9FT4X/qo6OsLjzgRef+yVUz71UelVe4I:8fpgY1FTmqJlLjz/f+sUv/Vep
TLSH
T195815DFC0CD8934AF9C0E43B8762BDD10C520D1B739231394AE2B66AF52A643764FC41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Decisions

Path C:\Users\Admin\AppData\Local\Temp\Decisions
Size 90KB
SHA256 f963e122315e0ce575434a490b07e40613d2ba03bea8dd1dad4ac524f1cee598
MD5 e25be5910ebda6e34986c422f9382410
SHA1 065a662a263c4e965e9112544d87338878cf9b44
SHA512 7a6d95a573822632feb4aa781cef29915733f44a9cc54d19eba037c571c4c6cd93b20c306d61c626fa202205704da92b9009ef3428ab9a628336784e62a63a2b
SSDEEP 1536:ySsvaYhQSeZasFi4HOo1Q0HPENTt8QvSMjmCVkHhZvhF6xycT+x6eSvRT5doFXR:gCYhq0BoxH4TiUSGVkBFhF6YcJv2X
TLSH
T12D93126DC691B797B0C156D54FBB03024ED0FA2CFC4D52FEABA30970C0721A49A7E259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hate

Path C:\Users\Admin\AppData\Local\Temp\Hate
Size 77KB
SHA256 5e54888d70ab86b213e90719dbad2e76f3938f1f19a120538071e7d25486ac0a
MD5 d7300859c10835c25e33e2c17c522fa7
SHA1 6a2d9443fb11f83dabea0c72fbd5e6d53ccf28a7
SHA512 ffe3a3ad37797dae5ea2c5dc1a33975781e774e19ba653cec19e4f6d62077b58efb66400ee43d699ceb103d3ecd8d5f94903a90161470a1fe8be9c34f4371e3e
SSDEEP 1536:p/JwgURRQ6fJN7LeU65BDCloHC2hWoq1kapMjadAdq9kgVQix:p/+gUL1LeU6/D2oHphW/xSAE4H
TLSH
T1487302A27796B523E64B9E7FD8F4DC10C553B6CEAE9AC10D80D58A0CD0605EACDC6217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lottery

Path C:\Users\Admin\AppData\Local\Temp\Lottery
Size 77KB
SHA256 0930b5e50539fa1f4c2700951ca0a1740653dcb03967b2292e8f1963a8a50486
MD5 250ceeff3869e839c472f7790db0b079
SHA1 663e10d8eecf52c26c61057d8d9f01dccb728ee3
SHA512 3866eafa74691bf5cecbe55d8b459dba9947de85c2b351c84a3b4cf5bea357dc24a462d5ae922e9b81e75a4edd029ccdccc6fbe0534106efbf884f63d50103d5
SSDEEP 1536:lnaD8oBtB7zEOlmGy2KO1TwG94mjnhdM2682cKZ:lBozB8OcGzKkTWzZ
TLSH
T1017302816F74479CA6AFE21BE932150870DCAC7534E1B77EF109AE2ECE52197630C1AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Memories

Path C:\Users\Admin\AppData\Local\Temp\Memories
Size 88KB
SHA256 be9c6a2903e3d363bad607c89e8079ff0b884679d52b92c312e2d34918f66385
MD5 38759fd824105a1ff390faa8fc231067
SHA1 415b3fde44cc5134775807f5aa30bee1debba22a
SHA512 cba7ce0baaea91fbc420aac08ffdb446c5cdfa573acd5e50af56f815fe8a3a11edb424713275e0f4af67c71d22e61f98e3b7dfbe80f1cc4ddd6cb9e123fa5fda
SSDEEP 1536:mFYIkXXIpjglmc+7jFBjwdglPmfAv2n7mCr/PJ3zCMxepaHAvv0xTLCytoSo:mTkX4pcUjszo25XJjC30AvcxTLttoSo
TLSH
T1359302B19558354D8E8785C77ABE0F5DC45F1380E86C237865CEAEB1CCA6FE28D21D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Propecia

Path C:\Users\Admin\AppData\Local\Temp\Propecia
Size 60KB
SHA256 1ae8bbd106478ebd304d056d3a1cbfc8a6dffb34249cfdbafde1653317d326f8
MD5 f1970e8f82e8b74923269aa1720acabf
SHA1 be6f27068ce6a95ea0c404dd3548094c5d103c50
SHA512 caaa7f2a211fe220b1101e0f38840053c143b7995d8a89539ba4bcb12e237763ee96e3b342cb25cc29c1441b85146f57cbc5e65843aa0f13fefb46cbd69e787a
SSDEEP 1536:aW11TwtItDI4CtiD8ORKCxhmR2EhjjLJUlj6+IdSHrtN:t1aetCiYORK8ZINUlj/HH
TLSH
T11A5302CD4ECAB7018FD5C2C2BAC70BAE5B0EA9004A2BCA77D875D398915B06D50786F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rise

Path C:\Users\Admin\AppData\Local\Temp\Rise
Size 925KB
SHA256 1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49
MD5 62d09f076e6e0240548c2f837536a46a
SHA1 26bdbc63af8abae9a8fb6ec0913a307ef6614cf2
SHA512 32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f
SSDEEP 24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
TLSH
T160158C0333918062FEA7A5331F5FF7265B7C6D2A0223A52F13981E79B9705B1162E673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Sg
Size 86KB
SHA256 c7ad6c475b8eaaeb3a43d0b1a28f25bf51ad5cfc8ab99e2dfc8370ba06e68a58
MD5 cc2b42799a65cec0d03bc8b68b9c19ed
SHA1 1a87850620711b0326cdb11f430ac92b06635fdd
SHA512 7fe59a652aac499ffb41aad67b3d0946c359d632c3d4f25dfb7f3141f2b90a690b028ccd75bfc6242b6eab560cdf30bb1c3dc232d2fed040d1980d506f0fea6a
SSDEEP 1536:uXpxNjtJLABF3YHdi0MBLSZaPvJPWIT9uKM9XfEAfr9ZVPB0j:uXpTi1YHM0MBLSZKPLuH5dr93Zc
TLSH
T16E83021D3AACF4B8A7715C560565EF0CBA510628A0FC16042FFBF670F2EA5589DBC8A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5760-21-0x00000000003E0000-0x000000000043B000-memory.dmp

Download

memory/5760-22-0x00000000003E0000-0x000000000043B000-memory.dmp

Download

memory/5760-23-0x00000000003E0000-0x000000000043B000-memory.dmp

Download

memory/5760-25-0x00000000003E0000-0x000000000043B000-memory.dmp

Download

memory/5760-26-0x00000000003E0000-0x000000000043B000-memory.dmp

Download

memory/5760-24-0x00000000003E0000-0x000000000043B000-memory.dmp

Download